CVE-2015-2851
UnknownEPSS 0.75%
Last modified
CVE-2015-2851 is a vulnerability of currently unknown severity. client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.. EPSS estimates a 0.75% chance of exploitation in the next 30 days.
Description
client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Synology | Cloud Station | 1.1-2291 |
| Synology | Cloud Station | 2.0-2291 |
| Synology | Cloud Station | 2.0-2402 |
| Synology | Cloud Station | 2.1-2561 |
| Synology | Cloud Station | 2.1-2570 |
| Synology | Cloud Station | 2.1-2577 |
| Synology | Cloud Station | 3.0-3005 |
| Synology | Cloud Station | 3.0-3103 |
| Synology | Cloud Station | 3.0-3108 |
| Synology | Cloud Station | 3.0-3109 |
| Synology | Cloud Station | 3.0-3111 |
| Synology | Cloud Station | 3.1-3317 |
| Synology | Cloud Station | 3.1-3320 |
References
- http://www.kb.cert.org/vuls/id/551972Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-9VBU45Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/551972Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/BLUU-9VBU45Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-2851?
client_chown in the sync client in Synology Cloud Station 1.1-2291 through 3.1-3320 on OS X allows local users to change the ownership of arbitrary files, and consequently obtain root access, by specifying a filename.
How severe is CVE-2015-2851?
Severity scoring for CVE-2015-2851 is pending analysis. The EPSS model estimates a 0.75% probability of exploitation in the next 30 days.
How do I fix CVE-2015-2851?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-2845The cpanel function in go_site.php in GoAutoDial GoAdmin CE …
- CVE-2015-2846BitTorrent Sync allows remote attackers to execute arbitrary…
- CVE-2015-2847Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-s…
- CVE-2015-2848Cross-site request forgery (CSRF) vulnerability in Honeywell…
- CVE-2015-2849SQL injection vulnerability in main.ant in the ANTlabs InnGa…
- CVE-2015-2850Cross-site scripting (XSS) vulnerability in index-login.ant …
- CVE-2015-2852Cross-site request forgery (CSRF) vulnerability in the WebUI…
- CVE-2015-2853Session fixation vulnerability in the WebUI component in Blu…
- CVE-2015-2854The WebUI component in Blue Coat SSL Visibility Appliance SV…
- CVE-2015-2855The WebUI component in Blue Coat SSL Visibility Appliance SV…
- CVE-2015-2856Directory traversal vulnerability in the template function i…
- CVE-2015-2857Accellion File Transfer Appliance before FTA_9_11_210 allows…9.8
Are you affected by CVE-2015-2851?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST